CVE-2005-4360

The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to ".dll" followed by arguments such as "~0" through "~9", which causes ntdll.dll to produce a return value that is not correctly handled by IIS, as demonstrated using "/_vti_bin/.dll/*/~0". NOTE: the consequence was originally believed to be only a denial of service (application crash and reboot).

CVSS v2.0 7.8 HIGH

7.8^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:C/A:N

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact COMPLETE

Availability Impact NONE

References

Link	Resource
http://ingehenriksen.blogspot.com/2005/12/microsoft-iis-remote-dos-dll-url.html	Exploit Vendor Advisory
http://secunia.com/advisories/18106	Exploit Vendor Advisory
http://www.securityfocus.com/bid/15921	Third Party Advisory VDB Entry
http://securitytracker.com/alerts/2005/Dec/1015376.html	Third Party Advisory VDB Entry
http://www.osvdb.org/21805	Broken Link
http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html	Issue Tracking Third Party Advisory
http://www.us-cert.gov/cas/techalerts/TA07-191A.html	Third Party Advisory US Government Resource
http://securityreason.com/securityalert/271	Third Party Advisory
http://www.vupen.com/english/advisories/2005/2963	Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1703	Third Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-041	Patch Vendor Advisory
http://www.securityfocus.com/archive/1/419707/100/0/threaded	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:microsoft:internet_information_services:5.1:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:-:*

Information

Published : 2005-12-19 17:03

Updated : 2021-11-08 13:45

NVD link : CVE-2005-4360

Mitre link : CVE-2005-4360

JSON object : View

CWE

CWE-252

Unchecked Return Value

Products Affected

microsoft

windows_xp
internet_information_services

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://ingehenriksen.blogspot.com/2005/12/microsoft-iis-remote-dos-dll-url.html", "name": "http://ingehenriksen.blogspot.com/2005/12/microsoft-iis-remote-dos-dll-url.html", "tags": ["Exploit", "Vendor Advisory"], "refsource": "MISC"}, {"url": "http://secunia.com/advisories/18106", "name": "18106", "tags": ["Exploit", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/15921", "name": "15921", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://securitytracker.com/alerts/2005/Dec/1015376.html", "name": "1015376", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "SECTRACK"}, {"url": "http://www.osvdb.org/21805", "name": "21805", "tags": ["Broken Link"], "refsource": "OSVDB"}, {"url": "http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html", "name": "SSRT071446", "tags": ["Issue Tracking", "Third Party Advisory"], "refsource": "HP"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA07-191A.html", "name": "TA07-191A", "tags": ["Third Party Advisory", "US Government Resource"], "refsource": "CERT"}, {"url": "http://securityreason.com/securityalert/271", "name": "271", "tags": ["Third Party Advisory"], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2005/2963", "name": "ADV-2005-2963", "tags": ["Vendor Advisory"], "refsource": "VUPEN"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1703", "name": "oval:org.mitre.oval:def:1703", "tags": ["Third Party Advisory"], "refsource": "OVAL"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-041", "name": "MS07-041", "tags": ["Patch", "Vendor Advisory"], "refsource": "MS"}, {"url": "http://www.securityfocus.com/archive/1/419707/100/0/threaded", "name": "20051216 Microsoft IIS Remote Denial of Service (DoS) .DLL Url exploit", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to \".dll\" followed by arguments such as \"~0\" through \"~9\", which causes ntdll.dll to produce a return value that is not correctly handled by IIS, as demonstrated using \"/_vti_bin/.dll/*/~0\". NOTE: the consequence was originally believed to be only a denial of service (application crash and reboot)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-252"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2005-4360", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:C/A:N", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "HIGH", "impactScore": 6.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2005-12-20T01:03Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:internet_information_services:5.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:-:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2021-11-08T21:45Z"}

7.8 /10